(address . bug-guix@gnu.org)
32a02946-4d85-472c-9035-42cfe3663a3c@posteo.net
Hi,
I was writing a service which (among other things) adds a setuid/setgid
binary for new account+groupn. I got errors and warnings when trying to
instantiate the operating system.
As a reproducer consider this os which tries to privilege the hello
package to a hello user and group (I started this operating system with
guix system container.):
#+begin_src scheme
(use-modules (gnu)
(gnu services))
(use-system-modules privilege shadow)
(use-package-modules base admin)
(define %hello-accounts
(list (user-group (name "hello") (system? #t))
(user-account
(name "hello")
(group "hello")
(system? #t)
(comment "hello user")
(home-directory "/var/empty")
(shell (file-append shadow "/sbin/nologin")))))
(define %hello-privileged
(list
(privileged-program
(program (file-append hello "/bin/hello"))
(setuid? #t)
(setgid? #t)
(user "hello")
(group "hello"))))
(define hello-service-type
(service-type
(name 'hello)
(extensions
(list (service-extension account-service-type
(const %hello-accounts))
(service-extension privileged-program-service-type
(const %hello-privileged))))
(default-value #f)
(description "Hello Reproducer")))
(operating-system
(host-name "hello-test")
(services
(cons (service hello-service-type) %base-services))
(file-systems (cons (file-system
(device (file-system-label "my-root"))
(mount-point "/")
(type "ext4"))
%base-file-systems))
(bootloader (bootloader-configuration
(bootloader grub-bootloader)
(targets '("/dev/sda")))))
#+end_src
* when setuid? is #t (regardless of setgid?) I get a fatal error:
setting up privileged programs in '/run/privileged/bin'...
Backtrace:
[...]
In gnu/build/activation.scm:
364:57 1 (_)
In unknown file:
0 (getpw "hello")
ERROR: In procedure getpw:
In procedure getpw: entry not found
Which seems to indicate that the user does not yet exist?
* when setuid? is #f, user field is commented and setgid? #t there is a
nonfatal warning, however privileging fails:
setting up privileged programs in '/run/privileged/bin'...
warning: failed to privilege
"/gnu/store/8bjy9g0cssjrw9ljz2r8ww1sma95isfj-hello-2.12.1/bin/hello": No
such file or directory
When the griup is changed to 0/"root" (the default) things work, i think
because that account already exists.
As another example: the opensmtpd-service-type adds its utilties as
setgid smtpq.
The systemtest is failing with the same error:
From the log
warning: failed to privilege
"/gnu/store/2ng9wzk5d13xcxhk7w7k5zzdm24shk91-opensmtpd-7.5.0p0/sbin/smtpctl":
No such file or directory
However things are very weird because I have the opensmtpd server
running and working locally.
maybe a weird race-condition between account-creation and setting up
privileged programs? Can we ensure that the account creation always
happens before privileged programs are created?